Survey after survey puts IoT security as a primary concern for enterprises. As IoT proliferation grows, vulnerabilities and attacks are also growing too. As the defacto protocol for IoT, the MQTT standard has been consistently evolving and between version 3.1.1 and version 5, it has a large repertoire of security features which, if implemented well, can thwart many kinds of attacks including denial of service and man in the middle attacks. Technical architects and IoT developers know that a solid security architecture for IoT will require encryption, authentication and authorization to run at scale. It is not an easy feat. In this webinar, we discussed the key security features of the MQTT protocol and how those are further enhanced with the HiveMQ Enterprise Security Extension. To watch the recording of this webinar, visit https://www.hivemq.com/webinars/iot-security-issues-and-mqtt/

1. Copyright © by HiveMQ. All Rights Reserved.

2. Copyright © by HiveMQ. All Rights Reserved.
Speaker
● Product Marketing lead at HiveMQ
● Telecoms, Unified Comms,
Networking, Software technology
● Solutions Architect and Product
Manager
● Based in Ottawa, Canada
gaurav.suman@hivemq.com
Gaurav Suman
https://www.linkedin.com/in/grvsmn/
@grvsmn
Product Marketing Director @HiveMQ

3. Copyright © by HiveMQ. All Rights Reserved.
Why is IoT Security on
top-of-mind for devs and
architects?

4. Copyright © by HiveMQ. All Rights Reserved.
The Internet of Things is HUGE
Copyright © by HiveMQ. All Rights Reserved.

5. Copyright © by HiveMQ. All Rights Reserved.
The risks are clear

6. Copyright © by HiveMQ. All Rights Reserved.
IoT security challenges are unique
● Low-power devices
Copyright © by HiveMQ. All Rights Reserved.
● Spread far and wide
● Long lifecycle of devices

7. Copyright © by HiveMQ. All Rights Reserved.
HiveMQ: Security
Copyright © by HiveMQ. All Rights Reserved.

8. Copyright © by HiveMQ. All Rights Reserved.
Multiple Security Layers
Network
Host
Application
Data
Enterprise
We will bankrupt ourselves in
the vain search for absolute
security.
- D.E. Eisenhower

9. Copyright © by HiveMQ. All Rights Reserved.
Securing the IoT connectivity stack

10. Copyright © by HiveMQ. All Rights Reserved.
What’s special about
MQTT?
Confidential and Proprietary. Copyright © by HiveMQ. All Rights Reserved.

11. Copyright © by HiveMQ. All Rights Reserved.
What Is MQTT?
• Easy on the device side, pushes all implementation
complexity to the server
• Publish/Subscribe based architecture
• Created for extreme scale and instant data exchange
• (I)IoT Messaging Protocol
• Built for machines and constrained devices (binary,
data agnostic)
• Designed for reliable communication over unreliable
channels

12. Copyright © by HiveMQ. All Rights Reserved.
Connected Car
IIoT /
Industry 4.0
Logistics Telecommunication
IoT Messaging
Middleware
MQTT Use Cases

13. Copyright © by HiveMQ. All Rights Reserved.
The MQTT specification ‘specifies’
MQTT solutions are often deployed in hostile communication
environments. In such cases, implementations will often need
to provide mechanisms for:
● Authentication of users and devices
● Authorization of access to Server resources
● Integrity of MQTT Control Packets and application data
contained therein
● Privacy of MQTT Control Packets and application data
contained therein

14. Copyright © by HiveMQ. All Rights Reserved.
MQTT Broker
• Conserve
• Decouple
• Centralize Policy

15. Copyright © by HiveMQ. All Rights Reserved.
Transport Encryption
● MQTT is based on TCP / IP Stack
● Port 1883: MQTT over TCP
/ TLS
● TCP connection can be secured by TLS
● Port 8883: MQTT over TLS

16. Copyright © by HiveMQ. All Rights Reserved.
How MQTT helps secure IoT

17. Copyright © by HiveMQ. All Rights Reserved.
Authentication and Authorization

18. Copyright © by HiveMQ. All Rights Reserved.
● Client ID
● Username
● Password
● Digital Certificates
● OAuth, JWT
Copyright © by HiveMQ. All Rights Reserved.
Authentication

19. Copyright © by HiveMQ. All Rights Reserved.
● Digital Certificates
● Wire the broker and the auth store
Copyright © by HiveMQ. All Rights Reserved.
Advanced Authentication Options

20. Copyright © by HiveMQ. All Rights Reserved.
● Typically relies on a public certificate
authority
● Can also work with private certificates
○ Only for closed networks
Using certificates for TLS

21. Copyright © by HiveMQ. All Rights Reserved.
● You need control over the MQTT client
● Managing the Certificate lifecycle
○ Certification Revocation Lists (CRLs)
○ Online Certificate Status Protocol
Copyright © by HiveMQ. All Rights Reserved.
Consider these when using X.509 based Authentication

22. Copyright © by HiveMQ. All Rights Reserved.
OCSP Stapling: Authentication at Scale

23. Copyright © by HiveMQ. All Rights Reserved.
Client Authentication (Identity and Access Management Systems)
● Different external systems can be used to
authenticate clients at a broker
● Client provides authentication data in the
CONNECT packet
● Broker looks up the authentication data in the
connected external systems
● External authentication systems:
○ LDAP
○ OAuth2.0
○ Databases
○ ACL
○ ...
Caution:
Not all brokers support a pluggable
authentication and authorization system!

24. Copyright © by HiveMQ. All Rights Reserved.
Creating Custom Authentication Logic

25. Copyright © by HiveMQ. All Rights Reserved.
● Publisher and Subscriber Authorization
○ Whether they can publish/subscribe
○ Which QoS level
○ Operations (read, write)
Copyright © by HiveMQ. All Rights Reserved.
Authorization

26. Copyright © by HiveMQ. All Rights Reserved.
Permissions

27. Copyright © by HiveMQ. All Rights Reserved.
Encryption

28. Copyright © by HiveMQ. All Rights Reserved.
Transport Encryption - Best Practices
• Use transport encryption (TLS)
• Use certificates from trusted CAs
• Use highest TLS version and secure
cipher suites

29. Copyright © by HiveMQ. All Rights Reserved.
Payload Encryption
● Use payload encryption instead
● Every clients needs to have key & secret
● BUT!: It leaks metadata
On very constrained devices transport encryption
may be not possible!

30. Copyright © by HiveMQ. All Rights Reserved.
DoS and Overload Protection
● Limit Connections and Connection Idle times
● Throttle Connection Rates including Burst Rates
● Throttle SSL Handshakes
● Throttle Network Bandwidth
● Cluster Overload Protection throttles overactive publishing
clients to prevent cluster overload
● Limit ClientID and topic length to prevent malfunctioning IoT
access

31. Copyright © by HiveMQ. All Rights Reserved.
Criteria for selecting the right MQTT Broker
• Performant, scalable and high available broker
• Compliance to the entire MQTT specification
• Monitoring of broker and tracing of devices
• Pluggable authentication & authorization system
• Overload Protection
• Supports TLS
• Professional support

32. Copyright © by HiveMQ. All Rights Reserved.
HiveMQ Security Architecture
● Pluggable Authentication and Authorization System
● Prebuilt Security Extension
● TLS secured communication
● Overload Protection and (D)DOS detection
● Fine grained permission system for MQTT clients and
HiveMQ Control Center users
● Chaining of auth mechanisms
● Default Deny-All behaviour
● Integrated monitoring system and over 1500 metrics
● 24/7 professional support

33. Copyright © by HiveMQ. All Rights Reserved.
HiveMQ Enterprise Security Extension
• Central management for IoT device and HiveMQ Control
Center authentication and authorization
• Flexible and easy integration with multiple external
authentication systems and data sources (e.g.
databases, LDAP, OAuth 2.0)
• High Scalability and reliability
• Default Whitelisting Concept
• Access log (rolling on daily basis)
• Provides maximum flexibility in defining authorization
rules

34. Copyright © by HiveMQ. All Rights Reserved.
Resources
Evaluate HiveMQ
Try HiveMQ Cloud
Get Started with MQTT
HiveMQ Enterprise Security Extension
Blog Series | MQTT Security Fundamentals
Watch Our Previous Security
Webinar Recording

35. ANY
QUESTIONS?
Reach out to community.hivemq.com

36. THANK YOU
Contact Details
Gaurav Suman
gaurav.suman@hivemq.com
https://www.linkedin.com/in/grvsmn/